Chinook crash: The unanswered software questions
A damning report issued this week has reminded the world that unexpected Chinook helicopter engine shutdowns and blowouts, in the years leading up to the disastrous 1994 Mull of Kintyre crash, mostly resulted from engine software that Ministry of Defence airworthiness experts had not been able to approve.
Leo King July 16, 2011
02Jun1994: Mull of Kintyre ZD576 Chinook crash CIA v B Army?
https://www.computerworlduk.com/infrastructure/chinook-crash-the-unans wered-software-questions-3291437/

A damning report issued this week has reminded the world that unexpected Chinook helicopter engine shutdowns and blowouts, in the years leading up to the disastrous 1994 Mull of Kintyre crash, mostly resulted from engine software that Ministry of Defence airworthiness experts had not been able to approve.

Lord Philip’s report– which finally cleared the two pilots of blame for the disastrous 1994 crash of a Boeing Chinook helicopter on the Mull of Kintyre that killed 25 intelligence personnel and a four-person special forces crew – highlights a raft of still-unanswered technical questions.

For 16 years, serious criticisms have been levelled by campaigners, around problems with the Chinook’s Full Authority Digital Electronic Control (FADEC) engine control software and the troubled upgrade that introduced it into the Mk 2 model helicopter type that crashed.

FADEC, which when it worked was an advanced system that made the pilots’ job easier, was not apportioned blame for having any role in the accident. But the report, which concentrated on the pilots, made clear the concerns of experts who had not been able to write off the chances of system failure.

Lord Philip noted that following the crash, the RAF investigating board of 1994 had concluded that while a technical failure “was unlikely to have been the direct cause” of the accident, “a malfunction or warning may have distracted the pilots and contributed to the accident”. He reached this conclusion despite MoD officials repeatedly telling ministers that the Chinook was so designed that if FADEC failed, competent pilots would still have able to land it safely.

The system, which controlled the helicopters’ Textron-Lycoming engines, had encountered serious problems since its introduction. Errors caused unexpected engine shutdowns, as well as surges in power that resulted in engines completely blowing out.

Related
Chinook crash report throws spotlight back on alarming aircraft software problems
Crash of Chinook ZD576 - the 16-year campaign for justice
Families of Chinook victims welcome crash review
Chinook Mull of Kintyre crash pilots exonerated after 17 years
The upgrade to Chinook Mk 2, beginning a year before the crash, was branded by the report as “fraught and to some degree chaotic”, with test flying suspended and aircraft coming back late from upgrades. Philip noted, “the operational imperative to keep the Chinook flying meant that the RAF was still getting to know what was essentially a new aircraft.” The upgrade had “unsurprisingly” generated “some concern amongst the aircraft’s pilots, air and ground crews”.

Such was the concern surrounding the upgrade that the RAF introduced a reduced weight limit for the helicopter before the crash – reducing by 25 percent what it was able to carry.

ComputerworldUK.com blogger and investigative journalist Tony Collins has written extensively on the FADEC engine fuel control system, highlighting the “positively dangerous” problems that MoD experts said they had found with the system months before the crash. Collins was publicly thanked by MPs from the floor of the House of Commons on Wednesday, alongside other campaigners and journalists, for his “massive contribution” in making sure the truth around the pilots saw the light of day.

The Philip report details a number of the major problems with the FADEC system while Chinook Mk 2s were being introduced into operational service.

“During this period, both at Boscombe Down [the RAF’s aircraft test and evaluation site, where the system was found to be ‘unsuitable for its purpose’] and in service with operational squadrons, the aircraft experienced unpredictable malfunctions. These mostly affected, but were not limited to, the engines and more particularly their [FADEC] system and led to undemanded shutdowns and surges in power, which could cause overheating to the point of self-destruction.

“Torque mismatching between engines and false captions were also experienced. It was sometimes difficult to identify which of the two engines was faulty and the application of remedial measures to the wrong engine could lead to catastrophic consequences.”

Related
Chinook software delays 'risked lives'
Chinook crash review panel calls for written evidence
Chinook crash review panel to be swamped in evidence?
Chinook crash report throws spotlight back on alarming aircraft software problems
The report noted that “most but not all of these malfunctions occurred when aircraft were [being tested] on the ground.”

Experts at RAF Boscombe Down refused to fly the helicopters, judging the aircraft as not airworthy and urging the MoD and air force "in the strongest possible terms" to end operational flights of the Chinook until corrective action was taken on FADEC.

The Philips report – in carefully-worded language designed not to apportion blame given the remit of the inquiry – notes that as the Mk 2 Chinook was being introduced, and before the crash, “several important meetings took place” between RAF personnel who were gravely concerned about the problems with the new helicopters. The report notes that these meetings “presented a challenge of leadership” and “relied upon” the “loyalty” of the personnel, who were increasingly concerned about the safety questions surrounding the aircraft.

A 1993 review of the FADEC software by EDS-SCICON found 485 anomalies after examining only 18 per cent of the software code.

In an apparent reference to the FADEC problems, the review by Lord Philip stated that “the doubts created by the terms of [the Air Accidents Investigation Branch inspector’s 1994 report] were reinforced by the history of the HC-2 [Chinook Mk 2] and in particular the catalogue of engine control and other malfunctions experienced both at Boscombe Down and by the Squadrons to which the HC-2 had been released”.

Philips noted that “prior to the crash, the aircraft was experiencing a number of malfunctions, the causes of which were not fully understood.

“We were told that, at the same time, and to some extent as a result, the flight manuals available to pilots were incomplete and in some respects misleading. Against that background, the possibility of the occurrence of a malfunction or malfunctions with which the crew were not fully equipped to cope could not be eliminated.”

FADEC was finally updated within four years of the accident, and the weight restriction was lifted so that the 24.5 tonne design limit could be carried, instead of the 18 tonne limit imposed following the software problems.

After the crash, a number of parliamentary inquiries were held into the accident, including the FADEC system and other technical issues. A 1998 report by the Defence Select Committee said that while performance had improved they were concerned that the software had not yet received full approval.

Two years later, a Public Accounts Committee report raised significant concerns over the lack of independent verification for the system and questioned the MoD’s testing and procurement. The PAC also said it found MoD assurances over the software’s safety “unconvincing”.

The PAC honed in on FADEC and said that technical malfunction on the helicopter had been a “potential” or “contributory” cause of the accident. This was an explicit rejection of the MoD’s official finding that the pilots had been grossly negligent.

Related
Chinook crash report throws spotlight back on alarming aircraft software problems
Crash of Chinook ZD576 - the 16-year campaign for justice
Families of Chinook victims welcome crash review
Chinook Mull of Kintyre crash pilots exonerated after 17 years
In 2002, the House of Lords Select Committee closely examined the introduction of FADEC, and concluded that due to possible technical problems on the helicopter, the pilots were not necessarily in control of the aircraft.

The Royal Air Force and subsequently the Ministry of Defence continued to maintain that the gross negligence of the pilots was the cause the crash and argued this position to Lord Philip, who clearly rejected the argument.

In Wednesday’s report, Lord Philip in some way sided with previous Ministry of Defence reviews that said no definitive technical reason for the crash could be assigned. But this was in part because the report sought to concentrate on the legal basis for the Royal Air Force and Ministry of Defence verdict that the sole cause of the accident was the pilots’ alleged negligence, an argument Philip says was totally “flawed” and “unfair”.

Tony Cable, the Air Accidents Investigation Branch inspector who in 1994 produced a detailed report on the disaster, had said that the pre-impact serviceability of the helicopter could not be positively verified – a reference to various technical concerns including, but not only, IT.

Cable, who had not been able to access all documents or personnel, said that he found no evidence of a technical malfunction. But the report by Lord Philip notes that given the extensive damage to the helicopter and the problems this caused with the investigations, this “did not mean that the absence of such evidence conclusively proved that there had been no malfunction”.

Lord Philip branded as “extremely regrettable” the MoD’s decision to turn a “deaf ear” and continually rebuff all of the concerns raised around blaming the pilots, especially given that they had an impeccable record of service and that there remained serious technological and legal questions.

Related
Chinook software delays 'risked lives'
Chinook crash review panel calls for written evidence
Chinook crash review panel to be swamped in evidence?
Chinook crash report throws spotlight back on alarming aircraft software problems
“Since 1995 the Ministry of Defence has continued resolutely to defend the finding of gross negligence and to rebuff all public and private representations that the finding should be reconsidered even when the representations included cogent arguments based on a sound understanding of the effect of the relevant Regulations,” said Lord Philip, regarding the requirement that deceased pilots only be blamed when there was no doubt whatsoever as to their failings.

“We find it extremely regrettable that the Department should have taken such an intransigent stance on the basis of an inadequate understanding of the RAF’s own Regulations in a matter which involved the reputation of men who died on active service.”

Also coming out this week is the controversy over the 1994 Chinnok crash. With the BBC highlighting the unproven s/w on the Chinook Mk2 which casts doubt on the conclusion that the pilots were to blame. The blame being made by the same people that approved the faulty s/w for operations... Hmmm. Talk about covering your backside... Tony. another for your conspiracy files, I think.

More developments this week from campaigning newspaper, Computer Weekly.

The Ministry of Defence has renewed its attack on the dead pilots of Chinook ZD576, after the publication of documents that revealed a "dangerous" flaw in software installed on the type of helicopter that crashed.

The BBC and Computer Weekly published details of internal MoD documents gone of which said a flaw in the safety-critical "Fadec" software on the Chinook Mk2 was "positively dangerous" on 4 January.

The newly-disclosed documents add to evidence that the Chinook Mk2 was not airworthy in June 1994 when Chinook ZD576 crashed on the Mull of Kintyre, killing all 29 on board, including 25 senior police and intelligence officers.

Senior officers found the two pilots Flight Lieutenants Jonathan Tapper and Rick Cook grossly negligent, although an RAF Board of Inquiry did not rule out a Fadec computer problem as a contributory factor.

Now Stephen Dalton, chief of the air staff, has written a response to media coverage of the new evidence.

He says: "We have always made clear that we would revisit the findings if new evidence was presented. Despite the efforts over many years of those campaigning to clear the pilots, including an exhaustive report submitted in 2008, no such evidence has ever been found.

"The computer software issues raised in the documents obtained by the BBC were well known at the time and had been factored into the operating instructions. These issues were discounted in the context of this accident following a thorough independent assessment by the Air Accident Investigation Branch.

"This led the Board of Inquiry to conclude - along with those who have repeatedly reconsidered this over the years - that there was no evidence of technical failure which would have been a factor in the crash. What was exposed, in a diligent and logical analysis, was that the pilots consciously breached their operating rules, thereby knowingly placing their aircraft, passengers, crew and themselves at risk.

"This was the basis for the gross negligence finding. The Chinook helicopter has a remarkable safety record and has proved a mainstay of recent operations. Aircraft losses are not always due to equipment failings and it is a disservice to our people, particularly those working heroically daily in Afghanistan, to see a conspiracy behind every tragic loss."

As usual with these sort of official statements... it ignores the fact the FADEC software was re-written after the crash (perhaps explaining the Chinook's safety record remaining good) and the fact that the Nimrod crash dammed the safety record of the RAF - hence not so much of a "conspiracy" (their word) so much as pointing out the obvious.

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot edit your posts in this forumYou cannot delete your posts in this forumYou cannot vote in polls in this forumYou cannot attach files in this forumYou can download files in this forum